Kubelet Event QPS Argument Set For Appropriate Event Capture

#!/usr/bin/env bash
# Remediate CIS OKE 3.2.7: ensure kubelet --event-qps=0 (every worker node)
# Run on each worker node as root.

set -euo pipefail

KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
TARGET_FLAG="--event-qps=0"

echo "[INFO] Ensuring kubelet drop-in directory exists: ${KUBELET_DROPIN_DIR}"
mkdir -p "${KUBELET_DROPIN_DIR}"

echo "[INFO] Ensuring ${KUBELET_DROPIN_FILE} exists"
touch "${KUBELET_DROPIN_FILE}"

echo "[INFO] Updating/adding ${TARGET_FLAG} in kubelet systemd drop-in"

# Ensure an Environment= line that contains KUBELET_KUBEADM_ARGS exists,
# then ensure it contains the desired flag and no conflicting --event-qps.
if grep -q 'Environment=.*KUBELET_KUBEADM_ARGS' "${KUBELET_DROPIN_FILE}"; then
  # Remove any existing --event-qps=... from that line, then append the correct flag if missing.
  sed -i \
    -e '/Environment=.*KUBELET_KUBEADM_ARGS/{
      s/--event-qps=[^" ]*//g
    }' \
    "${KUBELET_DROPIN_FILE}"

  if ! grep -q 'Environment=.*KUBELET_KUBEADM_ARGS.*--event-qps=0' "${KUBELET_DROPIN_FILE}"; then
    sed -i \
      -e '/Environment=.*KUBELET_KUBEADM_ARGS/{
        s/"$/ '"${TARGET_FLAG}"'"/
      }' \
      "${KUBELET_DROPIN_FILE}"
  fi
else
  # No KUBELET_KUBEADM_ARGS line yet; append one with the desired flag.
  cat <<EOF >> "${KUBELET_DROPIN_FILE}"
[Service]
Environment="KUBELET_KUBEADM_ARGS=${TARGET_FLAG}"
EOF
fi

echo "[INFO] Reloading systemd and restarting kubelet"
systemctl daemon-reload
systemctl restart kubelet.service

echo "[INFO] Checking kubelet status"
systemctl status kubelet.service -l --no-pager || true

echo "[INFO] Verifying kubelet process flags contain ${TARGET_FLAG} and no conflicting --event-qps"
ps_output="$(/bin/ps -fC kubelet || true)"

echo "${ps_output}"

if ! grep -q -- "${TARGET_FLAG}" <<< "${ps_output}"; then
  echo "[ERROR] kubelet is not running with ${TARGET_FLAG}." >&2
  exit 1
fi

if grep -q -- "--event-qps=" <<< "${ps_output}" && ! grep -q -- "--event-qps=0" <<< "${ps_output}"; then
  echo "[ERROR] kubelet is running with a conflicting --event-qps value." >&2
  exit 1
fi

echo "[INFO] Verification succeeded: kubelet is running with ${TARGET_FLAG}"